Privacy policy

1. Who we are

VisaElevate™ is part of ElevateInter™, registered with the Netherlands Chamber of Commerce (KvK) under number 98955411. ElevateInter™ is the controller for the processing described in this policy. "VisaElevate", "we" and "us" mean ElevateInter™ and its trade name VisaElevate™.

VisaElevate™ is a private visa and immigration consultancy, not affiliated with any government agency. We do not give legal advice, but we can put you in touch with qualified legal professionals. All decisions on applications are made by the competent authorities.

Questions about privacy can be sent to info@visaelevate.com.

2. What data we process

Depending on the service you use, we process among other things:

• Identification and contact details: name, date of birth, nationality, address, e-mail address, phone number and your contact preferences.
• Account details: sign-in details, language preference, settings, consents and when you sign in.
• Data for your application: details about your relationship or family, travel, stays, education, work, income and assets, and the details of your partner, host or sponsor in the Netherlands.
• Copies of documents: passport, identity card, residence permit, birth, marriage and single status certificates, bank statements, payslips, employment contracts, insurance policies and reservations.
• Special categories of personal data, where they appear in your application or documents: for example data about health (such as a TB test), sexual orientation (which a partner relationship can reveal) and religion or ethnic origin (shown on some documents).
• Criminal record data: for example a certificate of good conduct or a police clearance that belongs to an application.
• Data of minors: if an application concerns a child, we process the child’s data through the parent or legal guardian.
• Identification numbers, such as a Dutch citizen service number (BSN) or Thai ID number, only when an authority asks for it.
• Travel details: preferred dates, destinations, travellers, baggage and special assistance.
• Financial data: quotes, invoices, payments and payment arrears.
• Communication: e-mails, messages in the portal and notes of conversations, including via WhatsApp or other channels you choose.
• Referrals: the details a partner gives us about you, and the status and fee of that referral.
• Technical data: IP address, device and browser data, log files, security logs and website statistics.

3. Why we process data and on what legal basis

We only process personal data when there is a legal basis for it:

• Performance of the contract (Article 6(1)(b) GDPR): to advise you, keep your file and portal, check documents, prepare and submit applications, schedule appointments, find and book flights, communicate with you and invoice. Steps you ask for before a contract, such as a consultation request, are also included.
• Explicit consent (Article 9(2)(a) GDPR and Article 22(2)(a) of the Dutch GDPR Implementation Act (UAVG); for criminal record data Article 33 UAVG): for the special category and criminal record data in your application and documents, such as data about your relationship, health, children and criminal record. We need this data to help you with your visa application, booking flights and our other services. You give this consent with the tick box with which you send your request and accept our terms, or by uploading documents in the client portal, where this is stated. You can always withdraw it; after that we can no longer process that data and may not be able to provide the service (in full).
• Legal obligation (Article 6(1)(c) GDPR): for example the statutory retention of our accounts and answering lawful requests from authorities.
• Legitimate interest (Article 6(1)(f) GDPR): to secure our systems and your data, prevent fraud and misuse, improve our services, keep an archive of earlier applications for follow-up and future applications, collect payments, bring or defend legal claims, handle referrals from partners and inform clients and applicants about our services by e-mail. You can always object to this (see "Your rights").
• Consent (Article 6(1)(a) GDPR): for keeping data longer when you ask us to.

4. Artificial intelligence (AI)

Where possible we use AI tools to work faster and more carefully, for example for translations, summarising documents and checking them for completeness, and drafting texts.

A VisaElevate employee checks the outcome. We do not take decisions based solely on automated processing that have legal effects for you or similarly significantly affect you (Article 22 GDPR). Decisions on applications are always made by the competent authority.

The providers of these tools process data for us under their own data processing terms. They may be based outside the European Economic Area (see "Transfers outside the EEA"). Where the provider allows it, we choose settings under which your data is not used to train AI models. We have no influence on these providers’ systems and are not liable for incidents there for which we are in no way responsible (Article 82(3) GDPR).

5. With whom we share data

We do not sell your data. We only share data when this is necessary for the purposes above, with:

• Governments and authorities that handle your application or ask for it, such as the IND, embassies and consulates, visa application centres (such as VFS Global), municipalities and Thai ministries. We do this on your instructions.
• Service providers we engage for you or that you choose yourself, such as (sworn) translators, legalisation and courier services, legal professionals and lawyers, notaries, airlines, travel agencies, booking platforms and insurers.
• Our processors: providers of hosting and servers, e-mail, storage and backups, software, AI tools, website statistics and communication. We conclude a data processing agreement with them, or their data processing terms apply.
• The partner who referred you: only whether you became a client, the general status and the fee. Never your documents.
• Our accountant, bank and payment providers, debt collection agencies and legal advisers, for our accounts, payments and the collection of claims.
• Competent authorities, such as the police, the judiciary or the tax authorities, when the law requires us to.
• A successor or acquirer, if (part of) our business is transferred. Your data then remains covered by this policy.

We choose our partners and providers with care and work with them in good faith. Authorities and independent service providers, such as translators, legal professionals and airlines, are themselves responsible for how they process your data, under their own terms and privacy policy. No system or company is completely secure. We have no control over the systems and working methods of third parties, including our hosting, e-mail, storage and AI providers, and are not liable for an error, outage, data breach or other incident at a third party for which we are in no way responsible (Article 82(3) GDPR). We share no more with them than your application requires.

6. Transfers outside the EEA

Our staff work in the Netherlands and in Thailand, so data may be accessed from Thailand. We also use service providers outside the European Economic Area, for example in the United States.

Data needed for your application with a foreign authority or service provider (such as a Thai embassy, a ministry or an airline) is transferred because this is necessary for the performance of the contract with you (Article 49(1)(b) GDPR).

For other transfers we ensure appropriate safeguards, such as an adequacy decision of the European Commission (for example the EU–US Data Privacy Framework) or standard contractual clauses. On request we tell you which safeguard applies.

7. How long we keep data

We keep data no longer than needed for the purpose for which we process it, or as long as the law requires. Many clients come back for a next step: first a Schengen visa, later an MVV, then the (step)children, and after five years a permanent residence permit or naturalisation. That is why we keep your file long enough that you do not have to collect documents again each time. In practice:

• Your account, file and documents: as long as you are our client, and then up to 5 years after your last contact or activity, for an objection, an appeal, a follow-up or a new application. One month before we delete an inactive account, you receive an e-mail; if you sign in, it is kept.
• At your request we keep your file longer as an archive, for example for a later application, or delete it sooner (see "Your rights").
• Consultation and flight requests that did not become a file: 12 months.
• Invoices, payments and other data from our accounts: 7 years, because of the statutory tax retention period.
• Data needed for an unpaid invoice, a (threatened) dispute or a complaint: until it is fully settled and the statutory limitation period has expired.
• E-mail news: until you unsubscribe. After that we only keep the fact that you unsubscribed, so we do not contact you again.
• Copies of sent e-mails: 30 days. Security and audit logs: 24 months.
• Backups: encrypted, kept for a limited time in a fixed rotation. Deleted data then also disappears from the backups.

A different period is possible if the law requires it or if it is needed to defend ourselves against a claim. We may keep using templates, texts and examples we create in anonymised form, without your personal data. Archived data is only used for the purpose for which it was kept.

8. Security

• Documents are stored encrypted and only shown through our secure portal. There are no public links to your documents.
• Only staff working on your file have access, based on their role. They sign in with two-step verification.
• Every view and change of a document is recorded in an audit log.
• Our servers are in the European Union. Backups are encrypted and kept separately from the keys.
• Staff and processors are bound by confidentiality.

No system is completely secure. If we discover a data breach, we act as the law requires: where necessary we report it to the Dutch Data Protection Authority and inform you if the breach is likely to result in a high risk to you.

If you send us documents through channels other than the portal, such as ordinary e-mail or WhatsApp, you do so by your own choice and those channels are subject to the terms of their providers. Please use the portal where possible.

9. Your rights

You have the right to:

• access your data and receive a copy;
• have incorrect data corrected;
• have your data erased;
• have the processing restricted;
• object to processing based on legitimate interest, and always to direct marketing;
• receive your data in a common format or have it transferred;
• withdraw your consent. This applies to the future: what was done with your consent before remains lawful.

Send your request to info@visaelevate.com from the e-mail address we know you by, or use the privacy choices in the client portal. We may ask you to prove your identity. We reply within one month. For complex or numerous requests this can be extended by two months; we will then let you know.

A request is free of charge. For further copies we may charge a reasonable fee (Article 15(3) GDPR). If a request is manifestly unfounded or excessive, for example because it is repeated, we may charge a reasonable fee for the administrative costs or refuse the request (Article 12(5) GDPR).

Erasure is not always possible (straight away). We may keep data we need to comply with a legal obligation, such as the tax retention period, or to establish, exercise or defend legal claims (Article 17(3) GDPR). If an invoice is still unpaid, we keep your file, with the documents and work we prepared for you, as proof of our work and to collect the invoice, until it has been paid. The right of access gives you a copy of your personal data; documents, letters, forms and other work we prepare for you are delivered after payment. If you withdraw your consent or have your data erased while your application is ongoing, we may not be able to complete the service. Work already done remains payable under our terms of service.

Do you disagree with how we handle your data? Let us know. You can also file a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

10. News and offers

We now and then send clients and people who request a consultation or other service from us news and offers about our services by e-mail (legitimate interest; Article 11.7 of the Dutch Telecommunications Act). Others only receive news if they have given their consent.

Every message explains how to unsubscribe with one click. You can also unsubscribe in the client portal or via info@visaelevate.com. Messages about your ongoing application, your account and invoices are not marketing; you receive them as long as you are a client.

11. Cookies

On our website we use strictly necessary storage and statistics cookies from Google Analytics 4. They show us in a simple way how visitors use the website and roughly where they come from (country and city), so we can improve it. We use no advertising cookies and never send names, e-mail addresses or documents to Google. Statistics are on by default (legitimate interest). You can refuse them at any time with one click in the cookie notice or via "Cookie settings" at the bottom of every page; we then stop measuring immediately and remove the statistics cookies. Read more on our cookie page. The client portal and the CRM do not use statistics or advertising cookies.

12. Changes and language

We may change this privacy policy, for example for new services or new rules. The current version is always on this page. For important changes we inform you and, where needed, ask for your consent again.

This policy is available in several languages. If the versions differ, the Dutch version prevails.